rename: failover → fallback throughout codebase — this system is Fallback, state is FALLBACK; preserve conventional failover comparisons

Fallback/Manual-Fallback.md

@@ -352,7 +352,7 @@ ssh root@[HOST2-tailscale-ip] "docker inspect Emby --format '{{.State.Status}}'"
 
 ### 4. Critical Data Mirrored
 
-These shares must exist on HOST2 with current data from HOST1 before failover is needed:
+These shares must exist on HOST2 with current data from HOST1 before fallback is needed:
 
 ```
 /mnt/user/appdata-Fallback/Critical-Data    # auth stack — NPM, LLDAP, Authelia, certs
@@ -371,7 +371,7 @@ Sync is maintained continuously by `daily_sync_maintenance.sh` critical-data pro
 ### 5. DDNS TTL Set to 1 Minute
 
 Set in your DDNS provider settings. Higher TTL means users continue hitting the old IP
-for longer after failover. At 5-minute TTL, users can be hitting a downed server for up
+for longer after fallback. At 5-minute TTL, users can be hitting a downed server for up
 to 5 minutes before DNS switches.
 
 ### 6. Both Servers Running fallback.sh
@@ -398,7 +398,7 @@ current state, outage duration if not NORMAL, Tailscale reachability, and whethe
 fallback.sh is running.
 
 **Weekly health digest** (`weekly_health_digest.sh`) — reads the state file. If
-`DIGEST_SMART_ON_FAILOVER=true` and state is not NORMAL, it sends a notification even
+`DIGEST_SMART_ON_FALLBACK=true` and state is not NORMAL, it sends a notification even
 in smart mode — a non-NORMAL state at digest time needs attention.
 
 **Direct check:**
@@ -412,7 +412,7 @@ cat /boot/config/fallback_state.db    # raw state file
 
 ## ━━━ PROCEDURES ━━━
 
-### Running the Failover Test
+### Running the Fallback Test
 
 > This starts and stops real containers on both servers. Users will experience a brief
 > service interruption. Always run `--dry-run` first.